fix: sanitize Authorization and apikey headers from supabaseOptions

User-provided supabaseOptions.global.headers could include Authorization
or apikey, bypassing verified credentials. Strip both before spreading
user headers into the client options.

Author: tomaspozo

src/core/create-admin-client.ts

@@ -41,13 +41,19 @@ export function createAdminClient<Database = unknown>(
       : Errors[MissingSecretKeyError](name)
   }
 
+  // Sanitize auth headers — only the service-role key controls Authorization and apikey.
+  const safeHeaders = { ...supabaseOptions?.global?.headers }
+  delete safeHeaders.Authorization
+  delete safeHeaders.apikey
+
   // supabaseOptions uses `string` for schema; createClient<Database> expects a narrower type.
   return createClient<Database>(resolved.url, secretKey, {
     ...supabaseOptions,
     // Stripped — token injection is managed via the service-role key.
     accessToken: undefined,
     global: {
       ...supabaseOptions?.global,
+      headers: safeHeaders,
     },
     auth: {
       ...supabaseOptions?.auth,

src/core/create-context-client.ts

@@ -45,6 +45,11 @@ export function createContextClient<Database = unknown>(
       : Errors[MissingPublishableKeyError](name)
   }
 
+  // Sanitize auth headers — only verified credentials control Authorization and apikey.
+  const safeHeaders = { ...supabaseOptions?.global?.headers }
+  delete safeHeaders.Authorization
+  delete safeHeaders.apikey
+
   // supabaseOptions uses `string` for schema; createClient<Database> expects a narrower type.
   return createClient<Database>(resolved.url, anonKey, {
     ...supabaseOptions,
@@ -53,7 +58,7 @@ export function createContextClient<Database = unknown>(
     global: {
       ...supabaseOptions?.global,
       headers: {
-        ...supabaseOptions?.global?.headers,
+        ...safeHeaders,
         ...(token ? { Authorization: `Bearer ${token}` } : {}),
       },
     },